Privacy Policy

1. Data we process

• Account data: email address, display name, password hash or Google account identifier, optional profile photo, bio and interests.
• Travel preferences: your home city, travel dates, pricing preferences and saved meetup plans.
• Social data: friend connections, friend invitations you send, and messages you post in trip chats.
• Technical data: IP address, device and browser information, and security logs generated when you sign in.
• Email delivery data: delivery status of transactional emails we send you.

2. Purposes and legal bases

• Providing the Service — creating your account, searching flights, ranking meeting cities, managing friends and trips: performance of a contract (Art. 6(1)(b) GDPR).
• Transactional emails such as sign-in links, friend invitations and trip notifications: performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention, and keeping the Service reliable: legitimate interests (Art. 6(1)(f) GDPR).
• Optional features you explicitly enable, such as live fare lookups: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Complying with legal obligations: Art. 6(1)(c) GDPR.

3. Recipients and processors

We share data only with service providers acting as processors under Art. 28 GDPR: our hosting and database provider, our transactional email provider, and flight-pricing providers used to retrieve fares for the routes you search. We do not sell your personal data and we do not use it for third-party advertising.

4. International transfers

Some processors may process data outside the European Economic Area. Where that happens, transfers are safeguarded by the European Commission's Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account, trip and message data for as long as your account exists. When you delete your account, we delete or anonymise your personal data, except where longer retention is required by law or needed to resolve disputes. Cached fare data and security logs are kept for a short period and then deleted.

6. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at privacy@halvway.app.

7. Cookies and local storage

We use cookies and equivalent browser storage (localStorage) in two categories:

• Strictly necessary: your authentication session token, the page you were headed to before signing in, your cookie choice, and interface state such as which trip messages you have already read. These are required for the Service to function and are set on the basis of Art. 5(3) of Directive 2002/58/EC (no consent required) and Art. 6(1)(b) GDPR.
• Optional (analytics): aggregated usage measurement that helps us see which features are useful. These are only set if you press “Accept” in the cookie banner, on the basis of your consent (Art. 6(1)(a) GDPR).

We do not use advertising, profiling or cross-site tracking cookies, and we do not share cookie data with advertising networks. Session storage lasts until you sign out or it expires; your cookie choice is stored for up to 12 months.

You can withdraw or change your choice at any time by clearing your browser storage for this site, which makes the cookie banner appear again, or by using your browser's cookie controls. Declining optional cookies does not limit any feature of the Service.

8. Children

The Service is not directed at children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Changes and contact

We may update this Policy; material changes will be announced in the Service. Contact: Colab Solutions LLC, privacy@halvway.app.